HackZoneLabs News
Newsletter

CVE-2026-120017

Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)

  • Critical 10.0

Description

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.

Key facts

Published
10 Nov 2026
Last changed
11 Nov 2026
Assigned by
sap
EPSS
0.259% likely to be exploited in the next 30 days, higher than 17.707% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: none; Automatable: yes; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 10.0CVSS 3.1, Criticalfrom the CNA (sap)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
SAP_SESAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
  • Default status: unaffected
  • SAP_BASIS 702 (affected)
  • SAP_BASIS 731 (affected)
  • SAP_BASIS 740 (affected)
  • SAP_BASIS 750 (affected)
  • SAP_BASIS 751 (affected)
  • SAP_BASIS 752 (affected)
  • SAP_BASIS 753 (affected)
  • SAP_BASIS 754 (affected)
  • SAP_BASIS 755 (affected)
  • SAP_BASIS 756 (affected)
  • SAP_BASIS 757 (affected)
  • SAP_BASIS 758 (affected)
  • SAP_BASIS 816 (affected)
  • SAP_BASIS 920 (affected)
  • SAP_BASIS 921 (affected)
  • SAP_BASIS 922 (affected)

Timeline

  1. 10 Nov 2026 Published

Weakness

Related coverage

References